CVE-2021-45046—Apache Log4j2 Deserialization of Untrusted Data Vulnerability

PUBLISHEDvulnerability record
2023-05-01 · last modified June 21, 2025

Metadata

CVE ID：
CVE-2021-45046
项目：
Apache
产品：
Log4j2
添加日期：
2023-05-01
到期日：
2023-05-22
最后更新：
June 21, 2025

漏洞名称

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

描述

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

已知用于勒索软件活动吗？

勒索软件状态：
KNOWN

采集行动

Apply updates per vendor instructions.

其他说明

  • https://logging.apache.org/log4j/2.x/security.html
  • https://nvd.nist.gov/vuln/detail/CVE-2021-45046

相关 CWE

browse all CVEs